1. Field of the Invention
The present invention relates to N grouping of traffic and pattern-free Internet worm response system and method using the N grouping of traffic, and more particularly, to N grouping of traffic and pattern-free Internet worm response system and method using the N grouping of traffic, capable of properly dealing with various modifications of a worm by applying a detection method that uses results caused by the worm, getting out of a conventional method of detecting a worm through a cause of the worm.
2. Description of the Related Art
The Internet rapidly develops, causing lots of problems. One of most problematic issues is a security issue. Currently, lots of systems are exposed to an attack and intrusion. These intrusion behaviors are classified into misuse intrusion and abnormal intrusion according to types of intrusion models. A variety of intrusion detection techniques are introduced and intrusion detection systems (IDSs) having these instruction detection techniques are commercialized to deal with these intrusion behaviors, but most of them perform pattern-based detection. A pattern-free worm attack detection is still at an initial stage of concept establishment and research.
Most of the conventional approaches are occupied by a misuse intrusion detection model using a known rule, and a detection model for a pattern-free worm occupies a portion. The conventional misuse intrusion detection model is simple and has high accuracy, but cannot detect a newly generated worm or a modified worm, though modification is slight, because the conventional misuse intrusion detection model uses a known pattern. Therefore, a detection technique for a new pattern-free worm is required.
The pattern-free detection technique creates a model for a normal behavior pattern using an appropriate algorithm and automatically detects a behavior pattern that deviates from the created model. The pattern-free detection technique has an advantage of detecting even an unknown attack. When the pattern-free detection technique is used, the unknown attack can be detected but a new pattern (a behavior pattern, not an attack) that has not been studied may be detected as an attack. The pattern-free detection technique may be roughly classified into an estimation model and an explanation model. The estimation model has an object of judging whether a data set provided through studying is normal or abnormal after the normal data set for studying is provided. A technique or method that has influenced on the estimation model includes ADAM, PHAD, next-generation intrusion detection expert system (NIDES), artificial intelligence (AI), information theoretic measures, and network activity models. Unlike the estimation model, the explanation model detects an abnormal behavior pattern without any prior information regarding studied data. The explanation model is theoretically based on a statistical approach, clustering, outlier detection technique, and a state machine. Early alarming of a pattern-free worm and a countermeasure thereto are very important as a preventive measure for survival of an entire network. A support team of an Internet storm center (ISC) monitors data introduced to a database using automated analysis tool and visual tool, and explores activities that correspond to an all-out attack. The support team informs a found symptom to an Internet community via a main website of the ISC, or directly informs the found symptom to Internet service providers, new groups, or public information sharing forums through a mail or a material on a bulletin board.
However, such forecasting and alarming is by a forecast and alarm system using reports from people regarding damages rather than an automated system. Also, the forecast and alarm system generates an alarm and takes a countermeasure after attacks are made. Therefore, many improvements are required.